Product Configurator for WooCommerce < 1.7.3 — Unauthenticated Private/Draft Product Data Disclosure via pc_get_data

CVE-2026-11568 affects the Product Configurator for WooCommerce WordPress plugin in all versions prior to 1.7.3 (fixed June 8, 2026). The vulnerability resides in the pc_get_data AJAX action, which is registered on wp_ajax_nopriv_ (i.e., available to unauthenticated visitors). When an attacker supplies an arbitrary post ID, the endpoint returns configurator data — title, price, weight, stock status, and option-level pricing or SKUs — even for products in *private* or *draft* status. This bypasses WordPress's built-in post-visibility controls. The fix in 1.7.3 restricts the AJAX response to published products and requires edit_post capability plus a valid nonce for anything else.

The vendor CVSS of 7.5 HIGH is a mechanical output of the AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector, but it materially overstates real-world risk. The C:H rating implies disclosure of credentials, PII, or security-critical secrets — here, the exposed data is *product catalog metadata* (prices, SKUs, stock levels for unreleased items). That is commercially sensitive at most, not security-critical. There is zero integrity or availability impact, no path to code execution, no credential exposure, and no customer data at stake. The plugin has only ~3,000 active installations globally — a vanishingly small footprint. Combined with no known exploitation in the wild, no public PoC, and an EPSS of 0.46%, the real-world severity is LOW.

Sources.

1. OpenCVE — CVE-2026-11568 Details
2. WPScan — Product Configurator for WooCommerce Vulnerabilities
3. WordPress.org — Product Configurator for WooCommerce Plugin Page
4. WPScan — Vulnerability Detail (e208fee5)
5. CyberStrike — CVE-2026-11568
6. Hol Security — CVE-2026-11568 Advisory

Run this script on the WordPress host itself (or any machine with wp-cli access to the target site) as a user with read access to the WordPress installation directory. Usage: bash check_cve_2026_11568.sh /var/www/html (pass the WordPress root path as the first argument). No elevated privileges required — it only reads plugin files.

#!/usr/bin/env bash
# check_cve_2026_11568.sh — Detect CVE-2026-11568 in Product Configurator for WooCommerce
# Usage: bash check_cve_2026_11568.sh /path/to/wordpress
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

WP_ROOT="${1:-/var/www/html}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/product-configurator-for-woocommerce"
MAIN_FILE="$PLUGIN_DIR/product-configurator-for-woocommerce.php"

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "UNKNOWN — Plugin directory not found at $PLUGIN_DIR"
  exit 2
fi

if [ ! -f "$MAIN_FILE" ]; then
  # Try alternate main file names
  MAIN_FILE=$(find "$PLUGIN_DIR" -maxdepth 1 -name '*.php' -exec grep -l 'Plugin Name:' {} \; | head -1)
  if [ -z "$MAIN_FILE" ]; then
    echo "UNKNOWN — Cannot locate plugin main file in $PLUGIN_DIR"
    exit 2
  fi
fi

# Extract version from plugin header
VERSION=$(grep -i '^[[:space:]]*\*[[:space:]]*Version:' "$MAIN_FILE" | head -1 | sed 's/.*Version:[[:space:]]*//' | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not extract plugin version from $MAIN_FILE"
  exit 2
fi

echo "Detected Product Configurator for WooCommerce version: $VERSION"

# Compare versions: vulnerable if < 1.7.3
REQUIRED="1.7.3"
if printf '%s\n%s\n' "$REQUIRED" "$VERSION" | sort -V | head -1 | grep -qx "$REQUIRED"; then
  # VERSION >= REQUIRED
  echo "PATCHED — Version $VERSION >= $REQUIRED (CVE-2026-11568 is fixed)"
  exit 0
else
  echo "VULNERABLE — Version $VERSION < $REQUIRED (CVE-2026-11568 applies)"
  exit 1
fi